D-Orbit and mhackeroni conduct in-orbit cybersecurity competition

SAN FRANCISCO – Italian space logistics company D-Orbit announced the conclusion Nov. 6 of CTRL+Space, Europe’s first in-orbit Capture-the-Flag (CTF) cybersecurity competition and the first live CTF contest involving multiple satellites.

Italian CFT team mhackeroni worked with D-Orbit to organize the CTRL+Space competition. The European Space Agency Security Cyber Centre of Excellence and the ESA Security Office supported the event, which was held at the Security for Space Systems Conference.

During the competition’s Nov. 4-6 finale, held at the European Space Research and Technology Centre in the Netherlands, five teams of hackers competed to identify and exploit vulnerabilities in computer systems in D-Orbit’s ION Satellite Carrier. Teams captured digital “flags” when they succeeded in breaching security systems.

D-Orbit’s ION Satellite Carrier employs “robust security measures” to ensure “all scenarios were executed in a secure, fully controlled environment, completely isolated from the satellite’s commercial mission,” according to the news release.

The CTRL+Space event attracted 559 teams with 299 completing at least one cybersecurity challenge. ENOFLAG, Superflat, RedRocket, CzechCyberTeam and PoliTech competed in the finals, with Superflat named the winner.

Satellite Vulnerabilities

“The space environment poses unique issues to the development of engaging challenges,” mhackeroni’s Daniele Lain, a postdoctoral researcher at the Swiss Institute of Technology in Zurich, said in a statement. “This one-of-a-kind event helps us understand how more conventional vulnerabilities and exploits can translate to satellite environments and their limitations.”

Antonios Atlasis, System Security Section chief at ESA’s Technology, Engineering and Quality Directorate, said in a statement that the Capture-the-Flag challenge provided European students with a unique opportunity to confront satellite cybersecurity challenges and “also proved that the implementation of cybersecurity protection measures in satellites is possible, even for the most challenging security scenarios.”

“Cybersecurity has become a fundamental pillar of the new space economy,” Grazia Bibiano, D-Orbit’s Portugal leader, said in a statement.

Since cybersecurity is a serious threat to space missions, companies and government agencies work with “ethical” hackers to identify vulnerabilities. In 2023, the U.S. Air Force invited teams attending the DEF CON conference in Las Vegas to hack into a cubesat in low-Earth orbit.